Pages does not automatically assign an HTTPS certificate to your domain, but for security, reliability, and search ranking, we strongly recommend completing HTTPS configuration.
HTTPS configuration is for configuring the available HTTPS certificate under your current domain, which will be deployed to EdgeOne edge nodes. Based on the certificate type you own, edge HTTPS certificate supports the following two configuration modes.
If you have not purchased an SSL certificate, EdgeOne can automatically perform free certificate application, deployment, and renewal to reduce Ops workload. The currently applied free certificate is an RSA certificate originating from Trust Asian and Let's Encrypt.
If you already owned a domain name certificate, you can upload the certificate to the Tencent Cloud SSL console and deploy it to the edge node. A maximum of one RSA, ECC, or SM2 certificate can be deployed to the EdgeOne node at the same time.
Force HTTPS Access
Force HTTPS Access is usually used for improving website security and protecting user privacy. If your business needs to protect user privacy and other sensitive information, enable this feature to ensure data encryption during transmission in order to improve security.
You can redirect client HTTP requests to HTTPS requests via 301, 302 and other methods, while client HTTPS requests remain unchanged.
Enable HSTS
To enhance access security, you can enable HSTS to force the browser to directly initiate HTTPS access. HSTS is an important security mechanism for high-security-level websites. After enabling HSTS, EdgeOne Pages adds a response header Strict-Transport-Security when responding to HTTPS requests. This header tells the browser to directly use the HTTPS protocol to initiate requests within the specified time.
Note:
When a client uses the HTTP protocol to make a request to an EdgeOne node, even if force HTTPS access is enabled to redirect the request to HTTPS, the first request still uses HTTP and may be intercepted or maliciously tampered with. Hence, when enabling HSTS, it is recommended to configure force HTTPS access, set up an SSL certificate for the domain, and ensure the user's first visit is performed via an HTTPS request.
OCSP Stapling
After enabling OCSP stapling, EdgeOne Pages will complete the OCSP query work and cache the query result to server. When the client performs TLS handshake with the platform, the platform will directly respond to client with OCSP information and certificate for verification, eliminating the need for the client to send query request to CA. This greatly improves TLS handshake efficiency, saves user authentication time, and optimizes HTTPS speed.
